2022 CVEs (page 152)
Page 152 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34652 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33149 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33148 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33147 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-32778 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32777 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32772 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32771 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32770 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32769 | Medium | 5.0 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32768 | Medium | 4.2 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32761 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32572 | High | 8.8 | 2022-08-22 | An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32282 | High | 8.8 | 2022-08-22 | An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash w… |
CVE-2022-30690 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP re… |
CVE-2022-30605 | High | 8.8 | 2022-08-22 | A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP reques… |
CVE-2022-30547 | Critical | 9.9 | 2022-08-22 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP req… |
CVE-2022-30534 | High | 8.8 | 2022-08-22 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-craft… |
CVE-2022-2842 | High | 7.3 | 2022-08-22 | A vulnerability classified as critical has been found in SourceCodester Gym Management System. This affects an unknown part of the file login.php. The manipula… |
CVE-2022-29468 | High | 8.8 | 2022-08-22 | A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to incre… |
CVE-2022-28712 | Critical | 9.0 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP… |
CVE-2022-28710 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP requ… |
CVE-2022-26842 | Critical | 9.6 | 2022-08-22 | A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A spe… |
CVE-2022-26061 | High | 7.8 | 2022-08-22 | A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execu… |
CVE-2022-25972 | High | 7.8 | 2022-08-22 | An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution… |
CVE-2022-25942 | High | 7.8 | 2022-08-22 | An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. A… |
CVE-2022-1930 | Medium | 5.9 | 2022-08-22 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary inpu… |
CVE-2022-33932 | Medium | 5.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vulnerability. An un… |
CVE-2022-32480 | Medium | 4.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource v… |
CVE-2022-31238 | Medium | 4.7 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulner… |
CVE-2022-31237 | Low | 3.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low p… |
CVE-2022-28598 | Medium | 6.1 | 2022-08-22 | Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in out… |
CVE-2022-35583 | Critical | 9.8 | 2022-08-22 | wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP… |
CVE-2022-35150 | Critical | 9.8 | 2022-08-22 | Baijicms v4 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-37134 | Critical | 9.8 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and th… |
CVE-2022-37133 | High | 7.5 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the… |
CVE-2022-36346 | Medium | 4.3 | 2022-08-22 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. |
CVE-2022-35656 | Medium | 4.5 | 2022-08-22 | Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. |
CVE-2022-35655 | Medium | 6.1 | 2022-08-22 | Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. |
CVE-2022-35654 | Medium | 6.1 | 2022-08-22 | Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. |
CVE-2022-34858 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. |
CVE-2022-34857 | Medium | 6.1 | 2022-08-22 | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress |
CVE-2022-34776 | Medium | 5.5 | 2022-08-22 | Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a s… |
CVE-2022-34775 | Medium | 6.3 | 2022-08-22 | Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, a… |
CVE-2022-34774 | Medium | 6.3 | 2022-08-22 | Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email a… |
CVE-2022-34773 | Medium | 4.9 | 2022-08-22 | Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of O… |
CVE-2022-34772 | Medium | 4.3 | 2022-08-22 | Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try loggin… |
CVE-2022-34771 | Medium | 5.5 | 2022-08-22 | Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the syst… |
CVE-2022-34770 | Medium | 4.6 | 2022-08-22 | Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previ… |
CVE-2022-34347 | Medium | 4.2 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-33900 | Medium | 4.1 | 2022-08-22 | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. |
CVE-2022-2873 | Medium | 5.5 | 2022-08-22 | An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA… |
CVE-2022-2600 | Medium | 5.4 | 2022-08-22 | The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the ta… |
CVE-2022-2594 | High | 8.8 | 2022-08-22 | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload fil… |
CVE-2022-2593 | High | 7.2 | 2022-08-22 | The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allo… |
CVE-2022-2558 | Medium | 5.3 | 2022-08-22 | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configur… |
CVE-2022-2557 | High | 8.8 | 2022-08-22 | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path travers… |
CVE-2022-2555 | Medium | 6.5 | 2022-08-22 | The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in a… |
CVE-2022-2552 | Medium | 5.3 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software… |
CVE-2022-2551 | High | 7.5 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin… |
CVE-2022-2544 | High | 7.5 | 2022-08-22 | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Dire… |
CVE-2022-2532 | Medium | 6.1 | 2022-08-22 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2022-2407 | Medium | 4.8 | 2022-08-22 | The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored… |
CVE-2022-2392 | Medium | 6.5 | 2022-08-22 | The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contribut… |
CVE-2022-2389 | Medium | 4.3 | 2022-08-22 | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not hav… |
CVE-2022-2388 | Medium | 6.5 | 2022-08-22 | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a lo… |
CVE-2022-2383 | Medium | 6.1 | 2022-08-22 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2022-2382 | Medium | 4.3 | 2022-08-22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authen… |
CVE-2022-2377 | Medium | 4.3 | 2022-08-22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary… |
CVE-2022-2375 | Medium | 5.4 | 2022-08-22 | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to upda… |
CVE-2022-2362 | High | 7.5 | 2022-08-22 | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possibl… |
CVE-2022-2361 | Medium | 4.8 | 2022-08-22 | The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-2312 | Medium | 5.4 | 2022-08-22 | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a… |
CVE-2022-2276 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete ar… |
CVE-2022-2275 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary pos… |
CVE-2022-2198 | Medium | 4.3 | 2022-08-22 | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messa… |
CVE-2022-2172 | Medium | 4.3 | 2022-08-22 | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF a… |
CVE-2022-25812 | High | 7.2 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as… |
CVE-2022-25811 | High | 7.2 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL sta… |
CVE-2022-25810 | Medium | 6.5 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin… |
CVE-2022-1932 | Medium | 6.1 | 2022-08-22 | The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflect… |
CVE-2022-1322 | Medium | 4.8 | 2022-08-22 | The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users… |
CVE-2022-1251 | Medium | 4.3 | 2022-08-22 | The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a u… |
CVE-2022-0446 | Medium | 4.8 | 2022-08-22 | The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Si… |
CVE-2022-2932 | Medium | 6.1 | 2022-08-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2. |
CVE-2022-2890 | Medium | 5.4 | 2022-08-22 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2930 | High | 7.8 | 2022-08-22 | Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-1340 | Medium | 5.4 | 2022-08-22 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2927 | Critical | 9.8 | 2022-08-22 | Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-2841 | Low | 2.7 | 2022-08-22 | A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2022-36251 | Medium | 6.1 | 2022-08-22 | Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php. |
CVE-2022-36198 | Critical | 9.8 | 2022-08-22 | Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, busp… |
CVE-2022-34916 | Critical | 9.8 | 2022-08-21 | Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data… |
CVE-2022-2885 | Medium | 4.8 | 2022-08-21 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-30036 | High | 8.8 | 2022-08-21 | MA Lighting grandMA2 Light has a password of root for the root account. NOTE: The vendor's position is that the product was designed for isolated networks. Als… |
CVE-2022-2921 | High | 8.8 | 2022-08-21 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation… |
CVE-2022-38493 | High | 7.5 | 2022-08-20 | Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Serv… |
CVE-2022-2909 | Medium | 6.3 | 2022-08-20 | A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2022-36030 | Critical | 9.8 | 2022-08-20 | Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of user input. This is… |